{"record":{"id":"fbb3b8d7e66bffe3","repo":"medusajs/medusa","slug":"provider-identity-with-entity-id-data-entity-id","errorCode":null,"errorMessage":"Provider identity with entity_id ${data.entity_id} and provider ${data.provider} not found","messagePattern":"Provider identity with entity_id (.+?) and provider (.+?) not found","errorType":"exception","errorClass":"MedusaError","httpStatus":400,"severity":"error","filePath":"packages/modules/auth/src/services/auth-module.ts","lineNumber":875,"sourceCode":"    data: AuthTypes.CreatePasswordResetTokenDTO,\n    @MedusaContext() sharedContext: Context = {}\n  ): Promise<AuthTypes.CreatePasswordResetTokenResponse> {\n    return await this.createPasswordResetToken_(data, sharedContext)\n  }\n\n  @InjectTransactionManager()\n  protected async createPasswordResetToken_(\n    data: AuthTypes.CreatePasswordResetTokenDTO,\n    @MedusaContext() sharedContext: Context = {}\n  ): Promise<AuthTypes.CreatePasswordResetTokenResponse> {\n    const [providerIdentity] = await this.providerIdentityService_.list(\n      { provider: data.provider, entity_id: data.entity_id },\n      {},\n      sharedContext\n    )\n\n    if (!providerIdentity) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        `Provider identity with entity_id ${data.entity_id} and provider ${data.provider} not found`\n      )\n    }\n\n    await this.invalidatePasswordResetTokens_(\n      providerIdentity.id,\n      sharedContext\n    )\n\n    const jti = crypto.randomUUID()\n    const expiresAt = new Date(\n      Date.now() + this.getPasswordResetTokenTtlMs_(data.ttl_seconds ?? 900)\n    )\n\n    await this.authPasswordResetTokenService_.create(\n      {\n        auth_identity_id: providerIdentity.auth_identity_id,","sourceCodeStart":857,"sourceCodeEnd":893,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/auth/src/services/auth-module.ts#L857-L893","documentation":"Thrown by createPasswordResetToken when no provider identity exists for the given entity_id + provider pair, so there is no account to reset a password for. Note it uses INVALID_DATA rather than NOT_FOUND.","triggerScenarios":"Calling createPasswordResetToken({ entity_id: 'unknown@x.com', provider: 'emailpass' }); provider typo (e.g. 'emailpass' vs 'password'); entity registered under a different auth provider.","commonSituations":"Password-reset request for an email that never signed up; users who authenticated via Google SSO requesting password reset; provider mismatch between signup and reset flows.","solutions":["Verify the provider string matches the one used at registration","Handle this error as 'no account found' and show a neutral message to avoid account enumeration","Check the provider identity exists with listProviderIdentities before creating the token"],"exampleFix":"// before\nawait authModule.createPasswordResetToken({ entity_id: email, provider })\n// after\nconst [identity] = await authModule.listProviderIdentities({ entity_id: email, provider })\nif (!identity) return { ok: true } // neutral response\nawait authModule.createPasswordResetToken({ entity_id: email, provider })","handlingStrategy":"validation","validationCode":"const [pi] = await authModule.listProviderIdentities({ entity_id: email, provider })\nif (!pi) return neutralResponse()","typeGuard":"null","tryCatchPattern":"try { await authModule.createPasswordResetToken(input) } catch (e) { if (/not found/.test(e.message)) return neutralResponse(); throw e }","preventionTips":["Return neutral responses on reset requests to avoid account enumeration","Verify provider strings match registration"],"tags":["auth","password-reset","not-found"],"backgroundTag":"account-not-found","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}